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1 . This action is responsive to the amendment tiled on November 1 7, 20 1 0. 

2. Claims 1,3-11, 13-17, 19-21 and 23-35 are presented for examination and claims 

2. 12, 18, 22 and 36 are canceled. 

3. The text of those sections of Title 35, U.S. code not included in this office action 
can be found in a prior office action. 

Claim Rejections - 35 USC §103 

4. Claims 1, 3, 5, 7-10, 13-17, 19, 28, 30-31 and 33-35 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Kirsch, US Patent 7,206,814 (hereinafter 
Kirsch) in view of Wang, US Patent Application Publication 2008/0040439 (hereinafter 
Wang). 

5. As per claims 1 and 35, Kirsch teaches the invention substantially as claimed, 
comprising: maintaining a reputation table in memory (i.e., list of information regarding 
the actual senders), the reputation table including information regarding a plurality of 
address-domain pairs(i.e., actual senders are identified by IP and domain pair), each of 
the plurality of address-domain pairs indicating an IP address and an associated domain 
of a previously received message (col. 3, lines 7-13; col. 9, lines 2 — 31; col. 11, lines 24- 
30; col. 16, lines 27-32), the information regarding each of the plurality of address- 
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domain pairs including one or more classification variables (i.e., scores are ratio of 
classification variables) (col. 11, lines 24-60); 

receiving the message transmitted over the network (col. 4, line 66-col. 5, line 
12); and 

executing instructions stored in a non-transitory computer readable storage 
medium to: 

determine an associated domain from which the received message is purported to 
be sent (col. 4, line 66-col. 5, line 12), 

identify that the determined domain appears on a whitelist (col. 4, line 66-col. 5, 
line 12), 

determine an IP address corresponding to a device from which the received 
message was relayed (col. 7, lines 35-37), 

associate the determined domain with the IP address to create an address-domain 
pair for the received message(col. 6, lines 10-40); 

classify the received message based on a score assigned to the address-domain 
pair, the score comprising a ratio (col. 12, lines 12-13) of a first classification variable of 
the address-domain pair to a second classification variable of the address-domain pair as 
indicated by the reputation table (col. 11, lines 24-60), and 

override the whitelist based on the score assigned to the address-domain pair, 
wherein the received message is classified as spam even though the domain of the 
received message appears on the whitelist (col. 19, lines 7-14). 



Application/Control Number: 10/776,677 Page 4 

Art Unit: 2453 

6. Kirsch does not teach variable decaying with time. Wang teaches the one or more 
classification variables decaying with time ([0046], [0047] and claims 5 and 22). 

7. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch and Wang because Wang's 
teaching of variables decaying with time would increase the security of their system by 
allowing their system to determine whether to accept or reject messages on the basis of 
the classification of the sender. 

8. As per claim 3, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach classifying the received message is further based on 
classification variables associated with another address-domain pair (i.e., classification 
based on range of IP combined with certain domain name), the other address- domain 
pair having a related IP address or related domain (col. 2, lines 58-64; col. 6, line 59-col. 
7, line 4). 

9. As per claim 5, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein a plurality of IP addresses is associated with 
the domain (col. 2, lines 63-64). 



10. As per claim 7, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teaches wherein the IP address is a boundary IP address 
(col. 7, line 30). 
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11. As per claim 8, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein the IP address is preconfigured (col. 4, line 
66-col. 5, line 6). 

12. As per claim 9, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Although Kirsch teaches wherein the IP address is preconfigured (col. 4, 
line 66-col. 5, line 6), however, Kirsch and Wang do not specifically teaches including 
wherein the IP address is preconfigured to be one hop from a gateway IP address. It 
would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to include IP address preconfigured to be one hop or any hop from a 
gateway IP address because by doing so it would increase the user control by allowing 
configuration according to the user's design choice. 

13. As per claim 10, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein the IP address is learned (col. 1, lines 24-25) 
(learned from the header). 

14. As per claim 13, Kirsch and Wang teach the invention substantially as claimed in 
claim 10 above. Kirsch further teach wherein the IP address is a boundary IP address 
(col. 7, line 30) and wherein the boundary IP address is learned by detecting a pattern in a 
certain number of previously received messages (col. 7, lines 20-45). 



Application/Control Number: 10/776,677 Page 6 

Art Unit: 2453 

15. As per claim 14, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein determining the domain from which the 
received message is purported to be sent includes identifying the stated sender domain 
associated with the received message (col. 7, lines 55-64). 

16. As per claim 15, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teaches wherein the domain is a domain associated with a 
boundary IP address (col. 7, lines 30, 49-54). 

17. As per claim 16, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein classifying the received message is further 
based on consulting a white list (col. 8, lines 31-38). 

18. As per claim 17, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein classifying the received message is further 
based on previous classifications made to the address-domain pair (col. 12, lines 1-30). 

19. As per claim 19, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach determining a spam ratio (col. 12, lines 12-14). 

20. As per claim 28, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teaches providing the classification of the received 
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message based on the address-domain pair as input to another classifier (col. 8, lines 17- 
62). 

21 . As per claim 30, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein classifying the received message is further 
based on a score assigned to the IP address (col. 12, lines 24-30). 

22. As per claim 31, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch further teach wherein classifying the received message is further 
based on a score assigned to the domain (col. 12, lines 24-30). 

23. As per claim 33, Kirsch and Wang teach the invention substantially as claimed in 
claim 30 above. Kirsch further teach comprising determining a score assigned to the IP 
address (Kirsch, col. 12, lines 1-30). 

24. As per claim 34, Kirsch and Wang teach the invention substantially as claimed in 
claim 3 1 above. Kirsch further teach comprising determining a score assigned to the 
domain (Kirsch, col. 12, lines 1-30). 

25. Claims 4 and 32 rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kirsch and Wang as applied to claim 1 above, and further in view of Lalonde et al, US 
Patent Application Publication 2004/0068542 (hereinafter Lalonde). 
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26. As per claim 4, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not the other message being associated with IP 
addresses other than the IP address of the message. Lalonde teaches wherein classifying 
the received message is further based on classifications of other messages associated with 
the domain of the received message (i.e., checking the blacklist) ([0042]), the other 
message further being associated with IP addresses other than the IP address of the 
received message ([0039]). 

27. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Lalonde because 
Lalonde 's teaching of further classification of the message would increase the security of 
Kirsch's and Wang's systems by further indentifying associated information regarding a 
message in order to determine and to filter unwanted message. 

28. As per claim 32, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Although Kirsch teaches classifying the message based on a score 
assigned to the domain (col. 12, lines 24-30), however, Kirsch and Wang do not 
determining the received message was forged. Lalonde teaches wherein classifying 
includes classifying the message based on the domain and determining that the received 
message was forged ([0038]). 

29. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Lalonde because 
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Lalonde's teaching of further classification of the message would increase the security of 
Kirsch's and Wang's systems by further indentifying associated information regarding a 
message in order to determine and to filter unwanted message. 

30. Claims 6, 1 1, 20-21 and 23-27 rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kirsch and Wang as applied to claim 1 above, and further in view of 
Murray et al, U.S. Patent 7,366761 (hereinafter Murray). 

31. As per claim 6, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not teach the IP address is associated with a plurality 
of domains. Murray teaches wherein the IP address is associated with plurality of 
domains (col. 7, line 65-col. 8, line 4). 

32. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Lalonde, Kirsch, Wang and Murray 
because Murray's teaching of the IP address is associated with plurality of domains 
would increase the effectiveness of their system by allowing identification of the IP 
address is associated with the domain in order to filter unwanted e-mails based on sender 
information. 

33. As per claim 11, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not teach including the IP address is adaptively 
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determined. Murray teaches wherein the IP address is adaptively determined (col.3, lines 
25-27). 



34. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of the IP address is adaptively determined would increase the 
effectiveness of their system by allowing determination of the IP address in order to filter 
unwanted e-mails based on sender information. 



35. As per claim 20, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches 
determining a spam rate (col. 10, lines 53-65). 



36. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of determining a spam rate would increase the effectiveness of their 
system by allowing identification of unwanted e-mails based on spam rate. 



37. As per claim 21, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches 
determining an estimated instantaneous spam rate (col. 10, lines 53-65; col. 11, lines 24- 
27). 
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38. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of determining a spam rate would increase the effectiveness of their 
system by allowing identification of unwanted e-mails based on spam rate. 

39. As per claim 23, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not teach giving a classification weight relative to 
another classification. Murray teaches wherein classifying the received message includes 
giving a classification variable greater weight relative to another classification variable 
(col. 9, lines 20-31). 

40. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of giving a classification greater weight relative to another 
classification would increase the effectiveness of their system by allowing unwanted e- 
mails to be accurately identified based on sender's reputation. 

41 . As per claim 24, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not teach giving a classification weight relative to a 
computer classification. Murray teaches wherein classifying the received message 
includes giving a classification variable associated with user greater weight relative to a 
classification variable associated with computer classification (col. 8, lines 44-50; col. 9, 
lines 20-31). 
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42. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of giving a classification greater weight relative to a computer 
classification would increase the effectiveness of their system by allowing unwanted e- 
mails to be accurately identified based on complied sender's reputation. 



43. As per claim 25, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not teach giving weight of a good classification. 
Murray teaches wherein classifying the received message includes giving an 
indeterminate classification a fraction of the weight of a good classification (col. 9, lines 
20-31). 



44. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of giving weight to a good classification would increase the 
effectiveness of their system by allowing unwanted e-mails to be accurately identified 
based on sender's good reputation. 



45. As per claims 26 and 27, Kirsch and Wang teach the invention substantially as 
claimed in claim 1 above. Although Kirsch teaches the reputation table (col. 3, lines 7- 
13; col. 9, lines 20-31), however, Kirsch and Wang do not specifically teach the table 
indexed by IP address and domain. Murray teaches wherein the table is indexed by IP 
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address and domain wherein each cell includes information about previous classifications 
(col. 9, lines 32-40). 

46. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Murray because 
Murray's teaching of consulting a table of IP address and domain would increase the 
effectiveness of their system by allowing unwanted e-mails to be accurately identified 
based on sender's information. 

47. Claim 29 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over Kirsch 
and Wang as applied to claim 1 above, and further in view of Appleman, U.S. Patent 
Application Publication 2005/0076240 (hereinafter Appleman). 

48. As per claim 29, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Kirsch and Wang do not specifically teach a Bayesian classifier. 
Appleman teach wherein the other classifier is a Bayesian classifier ([0058]). 

49. It would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Kirsch, Wang and Appleman 
because Appleman's teaching of providing the IP address and domain classification as 
input to a Bayesian classifier would increase the effectiveness of their system by allowing 
unwanted e-mails to be accurately identified based on sender's information. 
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50. Applicant's arguments filed on 1 1/17/10 with respect to claims 1,3-11, 13-17, 19- 
21 and 23-35 have been considered but they are not persuasive. 

51. In the remarks, applicant argued that: 

(1) The prior arts of record fail to teach overriding the whitelist 
based on the score assigned to the address-domain pair, wherein 
the message is classified as spam even though the domain of the 
message appears on the whitelist. 

52. In response to point (1), applicant's argument has been considered and addressed 
to in the office action mailed 8/17/10. Specifically, Kirsch teaches message with 
information such as domain name in a whitelist (i.e. the sender has been whitelisted) is 
normally passed to the recipient (col. 5, lines 13-16). Kirsch further teach message of 
sender in the whitelist (message in the Inbox) can be changed to spam based on the 
calculated reputation of the sender from IP address and domain pair (col. 19, lines 7-14). 
This means changing to spam counteracts the normal operation of the whitelist (i.e., 
overriding the whitelist based on score assigned to the address-domain pair) 

53. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
advisory action. In no event, however, will the statutory period for reply expire later than 
SIX MONTHS from the mailing date of this final action. Any inquiry concerning this 
communication or earlier communications from the examiner should be directed to Philip 
C Lee whose telephone number is (571)272-3967. The examiner can normally be 
reached on 8 AM TO 5:30 PM Monday to Thursday and every other Friday. If attempts 
to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Krista 
Zele can be reached on (571) 272-7288. The fax phone number for the organization 
where this application or proceeding is assigned is 571-273-8300. Information regarding 
the status of an application may be obtained from the Patent Application Information 
Retrieval (PAIR) system. Status information for published applications may be obtained 
from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the 
PAIR system, see http ://pair-direc i. u sp to . gov . Should you have questions on access to the 
Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 
(toll-free). 



/Philip C Lee/ 

Primary Examiner, Art Unit 2453 
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